Your staff is already using ChatGPT.
The question is whether you know about it.
Shadow AI is not a future risk. It is happening today — in clinical documentation, in earnings analysis, in contract review. Bike4Mind deploys entirely in your AWS account so your teams get the AI they need without your data ever leaving your cloud.
The Five Questions Your Security Review Will Ask
We know these because we've answered them in enterprise procurement. Here they are, up front.
Where does the data go when a user submits a query?
Directly to the AI model running inside your AWS account. The query travels from your user’s browser to your VPC endpoint. It does not touch Bike4Mind infrastructure. Ever.
Who has access to our data besides our own staff?
No one at Bike4Mind. We do not operate your deployment. Your team manages access through your AWS IAM policies and Bike4Mind’s RBAC. You own the keys.
Can we get audit logs in a format our SIEM can ingest?
Yes. Every user action, model invocation, and admin change is logged to CloudTrail and your designated S3 bucket in structured JSON. Native ingestion into Splunk, Datadog, and CloudWatch.
What certifications and compliance frameworks do you support?
HIPAA, SOC 2 Type II compatible, GDPR, ITAR-ready, FedRAMP-ready (GovCloud deployment), SEC/FINRA data residency. See the compliance matrix below.
What happens if we need to terminate the relationship?
Your data stays in your AWS account. There is nothing to export, because we never held it. Uninstall the application layer. Your data remains under your KMS keys, indefinitely.
The Architecture Is the Answer
Not a compliance promise. A deployment topology. Your security architect can verify every claim independently.
┌─ Application Layer
│ ├─ Chat + RAG Engine
│ ├─ Voice Agent Runtime
│ ├─ Model Router (60+ models)
│ └─ Collaboration Services
│
├─ Your Data Layer
│ ├─ S3 (your bucket, your KMS key)
│ ├─ MongoDB (your cluster)
│ └─ Vector Store (your index)
│
└─ Model Layer
├─ AWS Bedrock (same account)
├─ Self-hosted models (your EC2/ECS)
└─ BYOK external models (optional)Nothing here.
Your data never crosses this boundary. Not because of a policy — because there is no infrastructure on this side to receive it.
Encryption at rest
AES-256 via your KMS keys. You rotate. You control.Encryption in transit
TLS 1.3. No unencrypted internal traffic.Zero external calls (FTR Mode)
AWS Bedrock only. All inference stays in your account.A BAA Is a Legal Document. Not an Architecture Guarantee.
When your AI vendor says "HIPAA compliant," they mean they'll sign a BAA. They cannot tell you where their infrastructure runs or what happens when their subprocessors change.
Vendor-Hosted AI
Your data routes through their servers
Shared compute with other customers
Vendor staff + subprocessors have access
Breach depends on their notification timeline
Auditor gets a vendor attestation
Your-Infrastructure AI
Data never leaves your VPC
Your compute, your isolation
Your IAM policies — no vendor access
Your perimeter, your incident response
Auditor gets your own CloudWatch logs
"The most secure BAA is the one you never needed to sign."
Built for Regulated Industries
If it survives ITAR, it survives the rest. We lead with the hardest requirements because everything else is a subset.
Healthcare
HIPAA Compliant by ArchitectureYour radiologists are already faster with AI-assisted reporting. The problem is the tool they found on their own. With Bike4Mind in your VPC, every query stays inside your perimeter and every session is logged to CloudWatch.
Banking & Finance
SEC · FINRA · SOXYour analysts are pasting earnings transcripts into consumer AI tools. That is MNPI leaving your network. Give them 60+ models inside your VPC with a complete supervisory audit trail your FINRA examiner can pull in seconds.
Defense & Space
ITAR · FedRAMP · GovCloudExport-controlled data demands export-controlled infrastructure. Your AWS GovCloud, your security clearance boundaries, your rules. Zero external API calls. No foreign dependencies in the call stack.
Government
FedRAMP · FISMA · NIST 800-53FedRAMP-ready architecture on GovCloud. PIV/CAC authentication roadmap. Continuous monitoring compatible. NIST 800-53 control mapping documentation available on request.
Compliance Framework Coverage
Every capability is independently verifiable in your own AWS account.
Framework | Requirement | How B4M Addresses It | Control Location |
|---|---|---|---|
HIPAA | PHI access controls and audit logging | IAM roles, session logging to CloudWatch, encryption at rest via your KMS | Your AWS Account |
FINRA 3110 | Supervisory procedures for communications | Complete AI interaction logs, immutable write-once S3 audit storage | Your AWS Account |
SOX §802 | Record retention and integrity | S3 Object Lock (WORM compliance), CloudTrail for all API activity | Your AWS Account |
ITAR | Export-controlled data containment | GovCloud deployment, zero external API calls, US-only model routing | Your AWS GovCloud |
FedRAMP | Government workload authorization | AWS GovCloud (FedRAMP High authorized), government model catalog | Your AWS GovCloud |
SEC 17a-4 | Electronic record preservation | S3 Object Lock compliance mode, 7-year retention configuration | Your AWS Account |
GDPR | Data residency and right to erasure | EU region deployment, bucket-level deletion, no cross-region replication | Your AWS EU Region |
SOC 2 Type II | Security, availability, confidentiality | Report available under NDA; architecture independently verifiable | Your AWS Account |
No Black Boxes in the Stack
We wrote the RAG pipeline, the model router, the document chunking, and the agent runtime from scratch. Not because we enjoy the work — because we needed to know exactly what every line of code does when it touches export-controlled data.
Zero Framework Lock-in
No LangChain. No N8N. No third-party orchestration layer. Every component is ours, which means it’s yours. When LangChain ships a breaking change, their users scramble. Your deployment? Rock solid.
Complete Auditability
Security-review every line of code. No hidden dependencies, no mystery packages, no supply chain attacks through transitive deps you didn’t choose. Full SBOM available on request.
Your Upgrade Timeline
You decide when to update. You decide what to merge. Your fork, your pace, your risk tolerance. No vendor-driven forced migrations.
No Upstream Surprises
When your security team does a network traffic analysis during onboarding, they will see zero outbound connections to Bike4Mind infrastructure. Not because we blocked them. Because we didn’t build any.
What We Do Not Do
We do not store copies of your data in our systems
We do not use your data to train models
We do not require access to your environment to provide support
We do not share audit logs with any third party
If a regulator asks us for your data, we do not have it to give
Your Compliance Team Has Questions. So Do We.
Tell us your framework. Tell us your use case. Tell us what your auditor asked last time. We've probably heard it before — and we know how the architecture answers it.
Response within 2 business days. No sales call required to receive security documentation.
HIPAA Ready
FINRA / SOX
ITAR Ready
Your AWS
Every other AI vendor asks you to trust their infrastructure. We deploy in yours. The difference is not a policy. It is physics.